Two disclosures a week apart in July described different products, different injection points and the same exit. On July 8, Noma Security published GitLost: GitHub Agentic Workflows induced by crafted public issues to exfiltrate private repository READMEs. On July 15, researchers published the Memory Heist: claude.ai memory exfiltrated through web_fetch link-following against attacker-controlled pages, dressed up with a fake Turnstile challenge as a cover story. Anthropic responded by disabling external link chaining.
The shared mechanism
In both cases the agent did exactly what it was built to do. It read content it was supposed to read, followed an instruction that arrived inside that content, and made an outbound request. The request went to a host the attacker controlled, and the sensitive material rode along in the URL. No malware, no stolen credential, no exploit against the runtime. The exfiltration channel was the agent's legitimate ability to fetch.
A separate July finding underlined the pattern from a different angle: Grok Build 0.2.93 was captured uploading full tracked Git bundles and history, an upload performed by the client itself rather than by a tool call, so tool-call permissions were not a sufficient control.
Why it matters
Defenses that sit in the prompt or in the tool policy have a structural problem here. The instruction to exfiltrate arrives as data, and the action that carries it out is one the agent is permitted to take. Vendors are patching individual paths, and each patch is correct. The class remains: an agent that can fetch arbitrary URLs can be made to fetch one that leaks.
What to do
- 01Enumerate which agents can fetch arbitrary URLs and which are limited to an allow list. The first group needs a network control, not only a prompt rule.
- 02Put fetch-capable agents under a policy in Enforce mode with a hold on first-seen destinations, and route the queue to the team that owns the agent.
- 03Alert on a spike of first-seen names from one agent identity. Exfiltration through a URL generates exactly that signal.
- 04For agents that must reach the open web by design, keep the hold short and review daily. A research agent's queue is its browsing history, and it is worth reading.